bc453bfe74803d4691f2d584d8a9006d9d856cbb5d2a8b173eb719445a045fd4

Sharing

Copy URL

Twitter E-mail

General

Target

bc453bfe74803d4691f2d584d8a9006d9d856cbb5d2a8b173eb719445a045fd4
Size

531KB
MD5

081fa59d4c8db4983ecedc5182091250
SHA1

1d2ef10ae19c188aad4e664903561d5272b232bb
SHA256

bc453bfe74803d4691f2d584d8a9006d9d856cbb5d2a8b173eb719445a045fd4
SHA512

6f6f5a18f4b26a28b8934dc8d425a824deaec65b9138e15235c1d12c0fdb8cde631ca96e2be5bd0835125d1488936c6811c1db12fb8b708b0881cbc96077d03b
SSDEEP

6144:7fJb0KrPqeKBRHWZGt9dPPjDz9k8A9g8teVC67fJ64dd2qA0n6BwonTufb:7JrPqp7N/hA9DU46LJ64dd2qt0w8

Score

N/A

Malware Config

Signatures

Files

bc453bfe74803d4691f2d584d8a9006d9d856cbb5d2a8b173eb719445a045fd4
.exe windows x86

f501f568320805732457c10cce5be9be

Code Sign

33:00:00:00:88:59:0e:3c:51:1f:e2:6a:67:00:01:00:00:00:88
Certificate

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

26-07-2012 20:50

Not After

26-10-2013 20:50

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

33:00:00:00:2b:39:32:48:c1:b2:c9:48:f3:00:00:00:00:00:2b
Certificate

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

04-09-2012 21:12

Not After

04-12-2013 21:12

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:C0F4-3086-DEF8,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

61:33:26:1a:00:00:00:00:00:31
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

31-08-2010 22:19

Not After

31-08-2020 22:29

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:16:68:34:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

03-04-2007 12:53

Not After

03-04-2021 13:03

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

e3:1f:a5:b8:a9:26:80:e3:dc:87:71:14:f0:6b:96:5d:0c:17:be:d1
Signer

Actual PE Digest

e3:1f:a5:b8:a9:26:80:e3:dc:87:71:14:f0:6b:96:5d:0c:17:be:d1

Digest Algorithm

sha1

PE Digest Matches

false

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

02-10-2012 11:14
Valid: false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

advapi32

RegCloseKey
RegCreateKeyExW
CreateProcessAsUserW
OpenProcessToken
GetTokenInformation
LookupAccountNameW
RegOpenKeyExW
RegQueryValueExW
RegSetValueExW
ConvertSidToStringSidW
ConvertStringSecurityDescriptorToSecurityDescriptorW
EventWrite
CredWriteW
RegQueryInfoKeyW
RegEnumKeyExW
RegDeleteValueW
RegDeleteKeyW
IsValidSid
GetSidSubAuthorityCount
GetSidSubAuthority

kernel32

TerminateProcess
GetModuleHandleW
GetShortPathNameW
FreeLibrary
GetProcAddress
LoadLibraryExW
GetVersionExW
CreateMutexW
GetDriveTypeW
LocaleNameToLCID
Sleep
SetFilePointerEx
SetFileAttributesW
FindFirstFileExW
FindClose
DeleteFileW
MultiByteToWideChar
ReleaseMutex
WriteFile
GetTickCount
GetSystemTime
GetExitCodeThread
GetCurrentThreadId
CreateThread
GetCurrentProcessId
CreateEventExW
OpenEventW
ResetEvent
SetEvent
LeaveCriticalSection
EnterCriticalSection
GetFileAttributesExW
CreateDirectoryW
ExpandEnvironmentStringsW
K32GetProcessImageFileNameW
K32GetModuleFileNameExW
K32EnumProcesses
GetModuleFileNameW
OpenProcess
GetPriorityClass
CreateProcessW
GetExitCodeProcess
WaitForSingleObjectEx
SetLastError
CloseHandle
QueryDosDeviceW
SetErrorMode
ProcessIdToSessionId
GetComputerNameW
WTSGetActiveConsoleSessionId
WideCharToMultiByte
GetLogicalDriveStringsW
FindNextFileW
RemoveDirectoryW
lstrcmpW
MoveFileExW
GetTempFileNameW
WaitForMultipleObjects
GetSystemTimeAsFileTime
GetNativeSystemInfo
SystemTimeToTzSpecificLocalTime
GetTimeZoneInformation
ReleaseSemaphore
CreateSemaphoreW
GetCommandLineW
SetCurrentDirectoryW
GlobalFree
CompareFileTime
GetFileSizeEx
GetFileTime
ReadFile
CopyFileW
DeleteFileA
GetTempPathA
CreateFileW
GetFileType
GetTempPathW
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
LocalAlloc
LocalFree
FormatMessageW
HeapSetInformation
GetStartupInfoW
EncodePointer
DecodePointer
RaiseException
RtlUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
HeapFree
HeapAlloc
HeapReAlloc
SetFilePointer
GetConsoleCP
GetConsoleMode
ExitProcess
GetStdHandle
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetHandleCount
InitializeCriticalSectionAndSpinCount
InterlockedIncrement
InterlockedDecrement
HeapCreate
QueryPerformanceCounter
HeapSize
IsProcessorFeaturePresent
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
LCMapStringW
GetStringTypeW
SetStdHandle
SetEndOfFile
GetProcessHeap
InterlockedExchange
WriteConsoleW
LoadLibraryW
FlushFileBuffers
LoadLibraryA
CompareStringEx
IsWow64Process
GetCurrentProcess
DeleteCriticalSection
InitializeCriticalSectionEx
GetLastError
FindFirstFileW

ole32

CoCreateInstance
CoTaskMemFree
CoUninitialize
StringFromIID
CoCreateGuid
CoInitializeEx

version

VerQueryValueW
GetFileVersionInfoW
GetFileVersionInfoSizeW

ws2_32

FreeAddrInfoW
GetAddrInfoW
WSAStartup

iphlpapi

FreeMibTable
CreateSortedAddressPairs

wer

WerReportAddFile
WerReportSubmit
WerReportCloseHandle
WerReportSetParameter
WerReportCreate

wevtapi

EvtExportLog

oleaut32

VariantInit
SysFreeString
SysAllocString
VariantClear

cabinet

ord14
ord13
ord10

wintrust

WinVerifyTrust

setupapi

SetupIterateCabinetW

Sections

.text
Size: 389KB - Virtual size: 388KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 18KB - Virtual size: 26KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 88KB - Virtual size: 92KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 35KB - Virtual size: 35KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

f501f568320805732457c10cce5be9be

Code Sign

33:00:00:00:88:59:0e:3c:51:1f:e2:6a:67:00:01:00:00:00:88Certificate

Extended Key Usages

Key Usages

33:00:00:00:2b:39:32:48:c1:b2:c9:48:f3:00:00:00:00:00:2bCertificate

Extended Key Usages

61:33:26:1a:00:00:00:00:00:31Certificate

Key Usages

61:16:68:34:00:00:00:00:00:1cCertificate

Extended Key Usages

Key Usages

e3:1f:a5:b8:a9:26:80:e3:dc:87:71:14:f0:6b:96:5d:0c:17:be:d1Signer

Signature Validations

Verification

02-10-2012 11:14 Valid: false

Headers

DLL Characteristics

File Characteristics

Imports

advapi32

kernel32

ole32

version

ws2_32

iphlpapi

wer

wevtapi

oleaut32

cabinet

wintrust

setupapi

Sections

.text Size: 389KB - Virtual size: 388KB

.data Size: 18KB - Virtual size: 26KB

.rsrc Size: 88KB - Virtual size: 92KB

.reloc Size: 35KB - Virtual size: 35KB

33:00:00:00:88:59:0e:3c:51:1f:e2:6a:67:00:01:00:00:00:88
Certificate

33:00:00:00:2b:39:32:48:c1:b2:c9:48:f3:00:00:00:00:00:2b
Certificate

61:33:26:1a:00:00:00:00:00:31
Certificate

61:16:68:34:00:00:00:00:00:1c
Certificate

e3:1f:a5:b8:a9:26:80:e3:dc:87:71:14:f0:6b:96:5d:0c:17:be:d1
Signer

02-10-2012 11:14
Valid: false

.text
Size: 389KB - Virtual size: 388KB

.data
Size: 18KB - Virtual size: 26KB

.rsrc
Size: 88KB - Virtual size: 92KB

.reloc
Size: 35KB - Virtual size: 35KB